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Abstract. A set theoretical assertion ij} is forceable or possible, 
written <}ip, if "0 holds in some forcing extension, and necessary, 
written dip, ii ip holds in all forcing extensions. In this forcing 
interpretation of modal logic, we establish that if ZFC is consistent, 
then the ZFC-provablc principles of forcing are exactly those in the 
modal theory S4.2. 

1. Introduction 

What are the most general principles in set theory relating forceabil- 
ity and truth? We are interested in how the set theoretical method of 
forcing affects the first order theory of a model of set theory. As with 
Solovay's celebrated analysis of provability, both this question and its 
answer are naturally formulated with modal logic. ^ We aim to do for 
forceability what Solovay did for provability. 

Forcing was introduced by Paul Cohen in 1962 in order to prove the 
independence of the Axiom of Choice AC and the Continuum Hypoth- 
esis CH from the other axioms of set theory. In an explosion of ap- 
plications, set theorists subsequently used it to construct an enormous 
variety of models of set theory and prove many other independence 
results. With forcing one builds an extension of any model V of set 
theory, in an algebraic manner akin to a field extension, by adjoining 
a new ideal object G, a \^-generic filter over a partial order P in the 
ground model V, while preserving ZFC. The resulting forcing extension 
V[G] is closely related to the ground model V, but may exhibit different 
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set theoretical truths in a way that can often be carefully controlled. 
The method has become a fundamental tool in set theory. 

Because the ground model V has some access via names and the 
forcing relation to the objects and truths of the forcing extension 
there are clear affinities between forcing and modal logic. (One might 
even imagine the vast collection of all models of set theory, related 
by forcing, as an enormous Kripkc model.) Accordingly, we define 
that a statement of set theory ip is forceable or possible if if holds in 
some forcing extension, and (p is necessary if it holds in all forcing 
extensions. The modal notation O (f and □ ip expresses, respectively, 
that (p is possible or necessary. This forcing interpretation of modal 
logic was introduced by the first author in [Ham03] in connection with 
the Maximality Principle, a new forcing axiom, with related work in 
[Lei04] and [HW05]. An alternative but related connection between 
modal logic and forcing was explored by Fitting and SmuUyan in [SF96], 
and Blass [Bla90] provides an interpretation of modal logic in set theory 
that is not directly related to forcing. 

These modal operators, of course, are eliminable in the language 
of set theory, because their meaning can be expressed in the usual 
language of set theory by means of the forcing relation or Boolean 
values. For example, O simply means that there is some partial 
order P and condition p G P such that plhpip, and □ (/? means that for 
all partial orders P and p G P we have p I hp (p. In this way, one can 
interpret O (p and □ (/? in any model of set theory.^ In ZFC we may freely 
use a mixed language of set theory with the modal operators O and □, 
understood with the forcing interpretation. While the modal operators 
O and □ are eliminable, we nevertheless retain them, because our goal 
is to discover which modal principles forcing must obey. 

For example, it is easy to see that □</?—></? is a valid principle of 
forcing, because if (/? is true in all forcing extensions, then it is true, as 
the universe is a (trivial) forcing extension of itself. Similarly, -> Oip ^ 
□ -lip is valid for forcing because a statement ip is not forceable if and 
only if all forcing extensions satisfy -k/?. The principle □</?—> □ □ </? is 



By formalizing forcing in ZFC, rather than the metatheory, one can sensibly 
force over any model of ZFC, without needing it to be countable or transitive and 
regardless of the metatheoretical objects, such as generic filters, which may or may 
not exist in a larger universe. In this syntactic account, one considers what is forced 
by various conditions without ever building the forcing extension as a structure. A 
semantic account of forcing over an arbitrary M \= ZFC is provided by the quotient 

/U of the Boolean valued universe M*" by any ultrafilter U, with no need for 
U to be M-generic (even U G M works fine!); since M maps elementarily into the 
ground model of M^/U, one has the forcing extension as an actual structure. 
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valid because if 9? holds in all forcing extensions, then so does □ 99, since 
any forcing extension of a forcing extension is a forcing extension. The 
reader may easily verify that □((/? ip) (□</?—> □ ■0) is valid. The 
principle ODv^^DOv^is valid for forcing, because if (p is necessary 
in V"^ and V'^ is an arbitrary extension, then ip is true in the product 
extension V'^^'^, as this extends V'^] consequently, p is forceable over 
every such extension V^*^. These modal assertions axiomatize the modal 
theory known as S4.2, and a bit of formalization will help us express 
what we have observed. A modal assertion is a formula of propositional 
modal logic, such as (□ go Qo), expressed with propositional variables 
Qi, Boolean connectives A, V, -1, — >, <-> and the modal operators O, □. 

Main Definition 1. A modal assertion p{qo, ■ ■ ■ ,qn) is a valid prin- 
ciple of forcing if for all sentences ipi in the language of set theory, 
(p{ipo, . . . , ipn) holds under the forcing interpretation of <> and □. 

More specifically, (p{qo, . . . ,qn) is a ZFC-provable principle of forcing 
if ZFC proves all such substitution instances p>{ipo, . . . ,ipn)- This nat- 
urally generalizes to larger theories with the notion of a T-provable 
principle of forcing. For any model W \= ZFC, the modal assertion 
(p{qo, ■ ■ ■ ,qn) is a valid principle of forcing in W if all substitution in- 
stances (pli^o, . . . , V'n) are true in W. So </? is a valid principle of forcing 
if it is valid in the universe V of all sets (this is expressed as a scheme), 
and the ZFC-provable principles of forcing are those provable in ZFC, 
as schemes, to be valid. 

Main Question 2. What are the valid principles of forcing? 

For the ZFC-provable principles of forcing, our Main Theorem 6 pro- 
vides the answer. Meanwhile, a few paragraphs ago, we essentially 
observed the following. 

Theorem 3. Every assertion in the modal theory S4.2 is a ZFC-provable 
principle of forcing. 

Proof. The modal theory S4.2 is obtained from the axioms 

K n{p) ^ ijj) ^ (np) ^ Dip) 

Dual -1 O □ -ip) 

S Op ^ p 

4 Up ^ nnp 

.2 on</?^no</? 

by closing under modus ponens and necessitation (from p>, deduce □ p). 
We observed earlier that each axiom is a valid principle of forcing. The 
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ZFC-provable principles of forcing are clearly closed under modus po- 
nens, and they are closed under necessitation because if (fi{ipo, ■ ■ ■ , V'n) 
holds in all models of set theory, then so does □ </?(V'o, ■ ■ ■ , V'n)- D 

Let us quickly show that none of the modal theories most commonly 
considered beyond S4.2 are ZFC-provable principles of forcing. This 
follows from our main theorem, but we find it informative to have 
explicit failing instances of the principles; they are what pointed to 
S4.2 as the right choice. 

5 OOif^ (p 

M DOip^ OD(p 

W5 oa(f ^ {(f ^ Dip) 

.3 0<pAOip^ {0{<fi A Oip) V OifAip) V 0{ip /\0(p)) 

Dm □(□(</? ^ Uifi) ^ ip) ^ {Onip ^ (fi) 

Grz □(□((/? ^ □(/?) ^ (/?) ^ (/? 

Lob o{n ip ^ ip) ^ nip 

H (p^n{0(p^ip) 

Observation 4. // ZFC is consistent, then none of the above assertions 
is a ZFC-provable principle of forcing. 

Proof. (5) Let (/? be the assertion "c<j|" is countable," where L denotes 
Godel's constructible universe. Since the class L is absolute to all 
forcing extensions, the expression lj\ refers to the same ordinal in all 
forcing extensions. Since forcing can collapse loi (see [Jec03, 14.3]), and 
it can never be uncollapsed, 0(p holds in any model of ZFC. But (p 
is false in L, so 5 is not valid for forcing over L. 

(M) This is the McKinsey axiom, also known as .1. The Continuum 
Hypothesis CH is forceable over any model of set theory (see [Jec03, 
ex. 15.15]), so □ O CH holds. But -iCH is also forceable ([Jec03, 14.32]), 
so O □ CH fails. Thus, M is invalid for forcing in every model of ZFC. 

(W5) Let (/? be the assertion "uj\ < Ui or CH," which is true in L, 
but not necessary there, since one can force -iCH without collapsing 
cui. Since one could collapse uji, however, (f is forceably necessary in 
any model of set theory. Thus, 0(f holds in L, but not </? ^ □ </?, 
and so W5 fails principle of forcing in L. 

(.3) Let ip assert "a;];' is collapsed, but not c^g" '4' assert "a;2 is 
collapsed, but not a;]"." These are each forceable over L, since u;^ and 
can be collapsed independently. Yet, whenever one of them holds, 
the other becomes unforceable. So the antecedent of this instance of .3 
is true in L, while the conclusion is false, so .3 is not valid in L. 

(Dm) This axiom is also known as Dum. Let ip assert "a;]" < cui 
or CH," as in case (W5). We observed that (p is possibly necessary. 
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but false in L, so L |= -^{Onip — >• (p), falsifying the conclusion of 
this instance of Dm. For the antecedent, suppose a forcing extension 
satisfies L''" |= Ui = uji. Since CH is forceable over L''' without collapsing 
uji, we conclude L'^ |= -i □((/? — * □ y?). It follows vacuously that L'^ |= 
o{ip —>■ nip) ^ ip. Alternatively, if L''" |= uj\ < uji, then ip is true 
there, so L''" |= n{ip ^ 0(p) (p. Thus, every forcing extension 
satisfies □(</? Hip) ^ ip, and so L |= □(□((^ — nip) ip), fulfilling 
the antecedent of Dm in L. So Dm is not valid for forcing over L. 

(Grz) This is the Grzcgorczyk axiom. Since Grz is stronger than 
Dm, it is invalid in L by the previous case. We will show, however, 
that Grz is invalid in every model of set theory. Let ip be the CH. Since 
-iCH is forceable over any model of set theory, □ <^ is always false, and 
so — > □ 93 is equivalent to -up. So this instance of Grz reduces to 
□ (□-iCH ch) CH. Since CH is always forceable, □ -^CH is false, 
making the first implication, and the hypothesis of this instance of 
Grz, vacuously true. So this axiom will fail whenever CH fails. Similar 
reasoning shows that if ip is -iCH, then the axiom fails if CH holds. So 
Grz fails as a principle of forcing in every model of set theory. 

(Lob) This axiom expresses the content of Lob's theorem in prov- 
ability logic, where one interprets Hip as "</? is provable." Under the 
forcing interpretation, however, it is invalid. If ip is CH, then □ 99 is 
always false, so □(□(/? ip) is always true. So in any model of set 
theory, the hypothesis of this instance of the Lob axiom is true, while 
the conclusion is false. So Lob is never a valid principle of forcing. 

(H) Let ip be the CH. As we have mentioned, this is necessarily 
possible, so Ov^ always holds. In this case, therefore, □(Ov' ^ v^) is 
equivalent to □ ip, which is false. So H fails in any model where CH is 
true. By using -iCH in the other models, we conclude that H fails as a 
principle of forcing in every model of set theory. □ 



The corresponding modal theories, listed below with their implica- 
tion diagram, are obtained by closing the axioms under modus ponens, 
substitution and necessitation. This list is not exhaustive, as there are 
continuum many modal theories above S4.2 that are not listed. We 
refer the reader to [CZ97] and [BdRVOl] for excellent developments of 
modal logic, including the analysis of these and many other theories. 
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S5 

Some Common Modal Theories 




K 



Corollary 5. // ZFC is consistent, then none of the modal theories S5, 
S4W5, S4.3, S4.2.1, S4.1, Dm.2, Dm, K4H, GL or Grz are ZFC-provable 

principles of forcing, and all are invalid in L. The modal theories S4.1, 
S4.2.1, K4H, GL and Grz are invalid as principles of forcing in every 
model of set theory. 

So if the ZFC-provable principles of forcing constitute any previously 
known modal theory, then the best remaining candidate is S4.2. 

This article is intended primarily for two audiences: set theorists 
interested in the fundamental principles of forcing and modal logicians 
interested in the application of their subject to set theory While we 
felt it necessary in the arguments to assume a basic familiarity with 
forcing, we do provide references to specific elementary forcing results 
in the standard set theory graduate textbooks where this might be 
helpful. We were able to provide in our arguments a complete account 
of the necessary concepts from modal logic. Sections 2 and 3 cover 
the proof of our Main Theorem 6, which answers our Main Question 2 
above. Section 2 contains a complete proof of the main theorem writ- 
ten primarily with the set theoretical reader in mind, and Section 3 
emphasizes certain aspects of the proof for the modal logicians. After 
this, we apply our technique fruitfully in Sections 4-6 to various other 
instances of Main Question 2, by restricting the focus to a given model 
of set theory, by investigating the role of parameters in the valid princi- 
ples of forcing, and by restricting attention to a natural class of forcing 
notions, such as those with the countable chain condition. 
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2. The Main Theorem 
Our main theorem provides an answer to Question 2. 

Main Theorem 6. // ZFC is consistent, then the ZFC-provable prin- 
ciples of forcing are exactly those in the modal theory S4.2. 

The rest of this section is devoted to the proof of this theorem, 
beginning with the key concepts of buttons and switches. A switch is 
a statement (p of set theory such that both if and -193 are necessarily 
possible, so that by forcing can be switched on or off at will. For 
example, the CH is a switch, because you can ensure either CH or -iCH by 
forcing over any model of set theory. In contrast, a button is a statement 
that is (necessarily) possibly necessary. The button is pushed when it 
is necessary, and otherwise unpushed. The idea is that you can always 
push a button by making it necessary, but having done so, you cannot 
unpush it again. The assertion "c<j^ is countable" is a button because 
it can be forced over any model of set theory and once it becomes true 
it remains true in all further extensions. This button is unpushed in L. 
The reader is invited to check that a statement is possibly necessary if 
and only if it is necessarily possibly necessary; at bottom, this amounts 
to the S4.2 validity of OUip ^ nODv?- Thus, a button remains a 
button in every forcing extension. Although it may seem at first that 
buttons and switches are very special sorts of statements, we invite 
the reader to check that in fact every statement in set theory is either 
a button, the negation of a button, or a switch (and these types are 
disjoint). 

A collection of buttons 6„ and switches Sm is independent in a model if 
first, all the buttons are unpushed in the model and second, necessarily 
(that is, in any forcing extension), any of the buttons can be pushed 
and any of the switches can be switched without affecting the value of 
any of the other buttons or switches. In other words, the collection of 
buttons and switches is independent in W if the buttons are unpushed 
in W, but in any forcing extension 1^''', whatever the pattern of buttons 
and switches is in W^, any button can be turned on by forcing to some 
yj/P*Q -vvithout affecting the value of any of the other buttons or switches 
and any switch can be turned either on or off by forcing to some H/'^*"^ 
without affecting the value of any of the other buttons or switches. It 
follows, of course, that any finite pattern of buttons and switches being 
on or off is possible by forcing over W. 

We note that the counterexample substitution instances showing the 
forcing invalidity of the modal assertions in Observation 4 were each 
Boolean combinations of independent buttons and switches. 
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Lemma 6.1. If V = L, then there is an independent collection of in- 
finitely many buttons and infinitely many switches. 

Proof. Let the button 6„ be the assertion "a;^ is not a cardinal," and 
let the switch Sm be the assertion "the GCH holds at Koj+m-" If V = L, 
then it is clear that none of the buttons is true, but in any model of 
set theory, the button 6„ can be made true by collapsing a;]^, without 
affecting the truth of any other button or the properties of the GCH 
above b^o, (see [Jec03, 15.21]). Once the button 6„ becomes true, it is 
clearly necessary, because the cardinal will remain collapsed in any 
further forcing extension. The switches Sm are clearly switches, because 
with forcing one can arrange the values of the continuum function at 
'i^ui+m at will by forcing that adds no new bounded sequences below 'ii^ 
(see [Jcc03, 15.18 & related]). Thus, the switches can be set to any 
desired pattern without affecting any of the buttons. □ 

A lattice is a partial order such that any two nodes a and b have a 
greatest lower bound or meet, denoted a A b and a least upper bound 
or join, denoted a V 6. It follows that every finite set A has a meet 
/\ A and join V A, and that a finite lattice has a least and a greatest 
element. 

Lemma 6.2. If F is a finite lattice and W is a model of set theory 

with a sufficiently large independent family of buttons bi, then to each 
node w E F we may assign an assertion Pw, a Boolean combination of 
the buttons, such that W satisfies: 

(1) In any forcing extension, exactly one of the Pu, is true. And 

Pwoj where Wq is the minimal node of F. 

(2) In any forcing extension satisfying p^, the statement py is force- 
able if and only if w < v in F. 

Proof. Let us associate a button bu with each node u E F. For any 
A C F, let bA = (AiteA '-' ^ (/\u(^a ^ sentence asserting 

that exactly the buttons in A are pushed and no others. Let Pw — 
\/{bA I w — y A} he the sentence asserting that the pattern of buttons 
that have been pushed corresponds to a set A with least upper bound 
w in F. Since every forcing extension must have some pattern A of 
buttons bu pressed and every such A has a least upper bound in F, it 
is clear that p^j will be true in the model if and only if w is the least 
upper bound of A. Thus, in any forcing extension exactly one of the 
Pw is true. And W \= p^,,,, as all buttons are unpushed in W. 

For the second claim, suppose that W[G] is a forcing extension where 
Pw holds. Let A = {u E F \ W[G] |= 6„ } be the set of buttons that are 
pushed in W[G] . Since p^ is true, it must be that w is the join of A in F. 
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If w < V in F, then by pushing the button and no others, we arrive 
at a forcing extension with buttons pushed in {t;}. Since 

this has join v, this means that p„ is true in and hence is 

forceable in as desired. Conversely, suppose that is forceable 

in Thus, there is some further extension satisfying p^. 

This extension exhibits some pattern of buttons {bu \ u E B }, where 
the join of B is v. Since PF[G'][i/] is a forcing extension of the 
buttons in A remain pushed in and so A ^ B. Thus, v must 

be at least as large as the join of A, which is w, so w <v in F. □ 

A pre-lattice is obtained from a lattice by replacing each node with a 
cluster of one or more equivalent nodes, all related by <. Equivalently, 
it is a partial pre-order < (a reflexive and transitive relation) on a set 
F, such that the quotient of F by the equivalence relation u = v 
u <v < u is a lattice under the induced quotient relation <. 

Lemma 6.3. // F is a finite pre-lattice and { bi, Sj }ij is a sufficiently 
large finite independent family of buttons and switches in a model of 
set theory W , then to each w E F we may assign an assertion p^, a 
Boolean combination of the buttons and switches, such that W satisfies: 

(1) In any forcing extension, exactly one of the p^ is true. And 
W \= pwQ for any desired node wq in the minimal cluster of F. 

(2) In any forcing extension satisfying p^, the statement pv is force- 
able if and only if w <v in F. 

Proof. The idea is to use the buttons as in Lemma 6.2 to determine 
which cluster is intended in the quotient lattice, and then use the 
switches to determine which node is intended within this cluster. Let 
[u] denote the equivalence class of u in the quotient lattice F/=, and 
let p[u] be the label assigned to [u] in Lemma 6.2. Thus, p[u] is the dis- 
junction of various complete patterns of buttons having supremum [u]. 
Suppose that the largest cluster of F has k nodes, and A: < 2". For each 
subset A C {0, . . . ,n — 1} = n, let sa = ( AigA ^i) ^ ( Ai^A ~''^«) assert 
that the pattern of switches is specified by A. Since every pattern of 
switches is possible by forcing over W, every sa is necessarily possible, 
and in any forcing extension of W, exactly one sa holds. For each clus- 
ter [u], assign to every w E [u] a, nonempty set Ay^ — {A^, . . . , AJ^ } of 

subsets of n in such a way that the various A^ for w E [u] partition the 
subsets A C n. We may assign the pattern A of switches that happen 
to hold in W to any desired node Wq in the minimal cluster of F. Let 
Sw — y A&A assert that the switches occur in a pattern appearing 

— * 

in Ayj. Finally, define pyj — p\^^ A s^. 
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We now prove that this works. In any forcing extension oi W, we 
know by Lemma 6.2 that exactly one is true. And any forcing 
extension exhibits some pattern A of switches being true, and this A is 
assigned to exactly one w E [u], so exactly one Sw is true for w E [u]. 
Thus, in any forcing extension, exactly one Pw = P[u] A is true. We 
arranged that pyj„ is true in W by the assignment of the pattern of 
switches holding in W to the world wq. 

If is a forcing extension satisfying p^, then both and hold 
in W^. If -u; < f in F, then we already know that p[y] is forceablc in 
W^, and is forceable from any extension of W without affecting the 
buttons, so Pv — P[v] A is forceable over W^, as desired. Conversely, 
if py is forceable over W^, this implies that p[v] is forceable over W^, 
and so [w] < [v] in the quotient lattice. It follows that w <v in F. □ 

We now state some definitions from modal logic. A propositional 
world, also called a state, is a map of the propositional variables to the 
set {true, false}. This is simply a row in a truth table. A Kripke model 
M is a set U of propositional worlds, together with a relation R on U 
called the accessibility relation. The Kripke semantics define when a 
modal assertion (f is true at a world w in a Kripke model M, written 
(M, w) 1= ip. Namely, for atomic assertions, (M, w) |= g if g is true in 
w; for Boolean connectives, one uses the usual inductive treatment; for 
necessity, (M, w) |= □ if whenever w Rv, then (M, v) |= </?; and for 
possibility, (M, w) |= O if there is v with w Rv and (M, v) \= (p. The 
underlying frame of the model M is the structure {U, R), ignoring the 
internal structure of the elements of U. The reader may easily check 
that every Kripke model whose frame is a partial pre-order satisfies 
S4, and every Kripke model on a directed partial pre-order satisfies 
S4.2. A deeper fact is Lemma 6.5, that the finite pre-latticc frames are 
complete for S4.2. The next lemma is the heart of our argument, where 
we prove that the behavior of any Kripke model on finite pre-lattice 
can be exactly simulated by forcing. 

Lemma 6.4. If M is a Kripke model whose frame is a finite pre-lattice 
with a world wq and W is a model of set theory with a sufficiently large 

independent family of buttons and switches, then there is an assignment 
of the propositional variables Qi to set theoretical assertions ipi, such 
that for any modal assertion (p we have 

{M,Wo) \= (p{qo, . . . ,qn) if and only if W \= ip{tpo, . . . ,ipn)- 

Proof. Each ipi will be a certain Boolean combination of the buttons 
and switches. We have assumed that the frame F of M is a finite 
pre-lattice. We may assume without loss of generality that Wq is an 
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initial world of M, by ignoring the worlds not accessible from wq- 
Let be the assertions assigned according to Lemma 6.3. Since 
Wo is an initial world of F, we may ensure that W \= Let 
ipi = \/{pw I {M,w) \= qi}. We will prove the lemma by establishing 
the following stronger claim. 

{M,w)\^ip{qo,...,qn) if and only if W \= a {py, ^ ip{^o, . . . ,ijjn)) 

This is true for atomic (/?, since qi is true at w if and only if pyj is one 
of the disjuncts of ipi, in which case ipi in any forcing extension 

of W, and conversely if Pw — ipi is true in a forcing extension where 
Pw is true, then ipi must be true there, in which case q^ is true at w 
in M. If the statement is true for and Lpi, then it is also true for 
(fiQ A ipi. For negation, suppose that {M,w) \= -^ip{qQ, . . . ,qn). By 
induction, W ^ □(p^ — > ^{'ipo, ■ ■ ■ , ipn)), so there is a forcing extension 
satisfying p^ and -'ip{ipQ, . . . ,ipn)- Since the truth values of ipi 
necessarily depend only on the values of the various p„, it follows that 
all forcing extensions with will satisfy -'iplipQ, .... tpn)- So we have 
proved W \= n{pyj -np{ilJo, . . . jipn)), as desired, and reversing the 
steps establishes the converse. Finally, {M,w) \= O <p{qo, ■ ■ ■ ,qn) if 
and only ii 3u > w (M, u) \= (p{qo, . . . ,qn), which occurs if and only 
if 1= d{pu (p{il)o,...,'ijjn))- Since W ^ □(p^ OPu), this 
implies W \= □(p^ —>■ O (fiiipo, ■ ■ ■ jipn)), as desired. Conversely, if 
W \= n{pw O fi^ipo, . . . , V'n))) then (p^ipo, . . . , ipn) is forceable over 
any extension of W with p^. Since all such extensions have p„ for 
some u > w and the ipi depend only on the values of p^, it must be 
that W \= □(pu — > ^pi'ipoj ■ ■ ■ li^n) foi' some u > w. By induction, this 
is equivalent to (M, u) \= (p{qo, . . . ,qn) and consequently to (M, w) \= 
0(p{qQ, . . . ,qn), as desired. □ 

The next step of our proof relies on a fact about S4.2. A tree is a 
partial order < on a set F such that the predecessors of any node are 
linearly ordered. A pre-tree is a partial pre-order < on a set F such that 
the quotient F/= is a tree; each node of this tree is effectively replaced 
in F with a cluster of equivalent nodes. A baled tree is a partial order 
< on a set F having a largest node b E F, such that F \ {b} is a tree 
(imagine baling or tying the top branches of a tree together, as in the 
figure below). A baled pre-tree is the result of replacing each node in a 
baled tree with a cluster of equivalent nodes; equivalently, it is a partial 
pre-order whose quotient by = is a baled tree. Note that every baled 
tree is a lattice, and every baled pre-tree is a pre-lattice. A partial 
pre-order is directed if any two nodes have a common upper bound. A 
modal logic © has the finite frame property if whenever © 1/ (/?, then 
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there is a finite 0-frame F and a Kripke model having frame F in 
which (f fails. 

Lemma 6.5. If a modal assertion (p is not in SA.2, then it fails in 
some Kripke model M whose frame is a finite baled pre-tree, and hence 
a finite pre-lattice. 

Proof. It is easy to see that every Kripke model whose frame is a di- 
rected partial pre-order satisfies S4.2 and conversely that any frame 
that is not a directed partial pre-ordcr has a Kripke model violating 
S4.2 (see [CZ97, Theorem 3.38]). This is what it means to say that 
S4.2 is defined by the class of directed partial pre-orders. By [CZ97, 
Theorem 5.33], it is known that S4.2 has the finite frame property, and 
so if S4.2 1/ then ip fails in a Kripke model Mq whose frame Fq is a 
finite S4.2 frame, which is to say, a finite directed partial pre-order. We 
will construct a Kripke model M that is bisimilar with Mq, and which 
consequently has the same modal theory, but whose frame is a finite 
baled pre-tree, and consequently a finite pre-lattice. Our construction 
is a minor modification of the standard technique of tree unravelling as 
described in the proof of [CZ97, Theorem 2.19]. We know that (p fails 
at some world Wq in Mq, and we may assume that Wq is in the smallest 
cluster of Fq. By dircctcdness, Fq has a largest cluster [b]. The quotient 
Fo/= is a finite directed partial order. For each [u] G Fo/=, let us say 
that t is a path from [wo] to [u] in Fq/= if it is a maximal linearly 
ordered subset of the interval [[wq], [u]] in Fq/=. Such paths form a 
tree when ordered by end-extension. Let F be the partial unravelling 
of Fo, except for the largest cluster. 

A partial order The resulting partial unravelling, a baled tree 

6 6 



1 1 

That is, F consists of the maximal cluster [6] of Fq, together with the 
set of all pairs {u,t), where t is a path from [wq] to [u] in Fo/= and 
[u] 7^ [b]. The order on F is by end-extension of the paths t and the 
Fq order on u, with [b] still maximal. The worlds within any copy of 
a cluster are still equivalent and consequently still form a cluster, and 
so F is a baled pre-tree. Let M be the resulting Kripke model on 
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F, obtained by also copying the propositional values from every world 
It e Fq in Mo to the copies {u,t) of it in F. It is easy to see that 
M is bisimilar with Mq, according to the correspondence that we have 
defined, because every world accesses in M all and only the copies of 
the worlds that it accesses in Mq. It follows that every world in Mq 
satisfies exactly the same modal truths in Mq that its copies satisfy 
in M. Consequently, (p fails at the copy of wq in M. Thus, (p fails 
in a Kripke model whose frame is a finite baled pre-tree, and all such 
frames are pre-lattices. □ 

Proof of Theorem 6. Finally, we prove the theorem. By Theorem 3, the 
ZFC-provable principles of forcing includes S4.2. If ip is not in S4.2, then 
by Lemma 6.5, there is a Kripke model M on a finite pre-lattice in which 
(p fails at an initial world. It is well known that if ZFC is consistent, 
then so is ZFC + V = L, and so by Lemma 6.1, there is a model of set 
theory L having an infinite independent family of buttons and switches. 
By Lemma 6.4, there is an assignment of the propositional variables of 
(p to sentences ipi such that L |= -i</7('0o, ■ ■ ■ , V'n)- Therefore, (p is not a 
valid principle of forcing in L, and hence not a ZFC-provable principle 
of forcing. □ 



While the previous section was written with a set theoretical reader 
in mind, let us now emphasize certain points for the modal logicians. 
The main theorem can be restated in a way (as follows) that aligns it 
with many other completeness theorems in modal logic. 

Theorem 7. // ZFC is consistent, then 

S4.2 h (/?(go, ■ ■ ■ gn) if and only if yipo, ... ,ipn 'ZFC \- ip{ipo, ■■■ ,ipn), 

where the ipi range over the sentences in the language of set theory and 
□ and O are understood in ZFC with the forcing interpretation. 

Modal logicians will recognize that Lemmas 6.2 and 6.3 assert exactly 
that the assertions Pw fulfill the relevant Jankov-Finc formula, which we 
now define. For any graph F = {U, E) , assign a propositional variable 
Pw to each vertex w & U ol the graph and let 5{F) be the following 
formula, the Jankov-Fine formula. It asserts that, necessarily, exactly 
one Pw is true, and if is true, then Opv if and only if w E v. 



3. The Jankov-Fine formula 



S{F) 



A 

A 



OPv) 
■^^OPv) 



A 
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Lemma 6.4 has nothing essentially to do with set theory, but rather 
only with Kripke models and the Jankov-Fine formula: 

Lemma 7.1. Suppose that M is a Kripke model whose frame F is a fi- 
nite partial pre-order and wq is a world of M. If N is any other Kripke 

model satisfying S4 (at some world uq) and the Jankov-Fine formula 
S{F) /\Pwa, then there is an assignment of the propositional variables 
Qi of M to assertions ipi in N such that for any modal assertion ip, 

(M, Wq) [= (p{qo, Qn) if and only if {N, uq) \= (^{^o, ■■■,^n) 

Proof. Wc argue just as in Lemma 6.4. Let p^, be the assertions in 
N satisfying the Jankov-Fine formula. Let ipi = \/{Pw \ {N,w) \= Qi}. 
We establish the following stronger claim by induction on (p: 

(M,w) 1= 9?(go, ■■■,?„) ^ {N,uo)\=a{p^^ip{'ilJo,...,'ilJn)). 

The atomic case holds by the definition of ipi. Conjunction follows 
because □ distributes over A. Negation follows via the properties of 
the Jankov-Fine formula, because every world in N (accessible from 
Uq) satisfies exactly one p^j, and any two such worlds agree on every 
ipi. Possibility follows using the Jankov-Fine formula again, since Pu is 
possible from a world with p^, if and only ii w < u in F. Finally, the 
stronger claim implies the lemma, because Pu,o is true at uq in N. □ 

A modal theory A is closed under substitution if '^{'ipo, . . . , ipn) is in A 
whenever ip{qQ, . . . ,qn) is, for any modal assertions ipi. If every Kripke 
model with frame F satisfies A, then F is a A-frame. 

Lemma 7.2. Suppose that F is a finite partial pre-order. If a modal 
theory A ^ SA is closed under substitution and is consistent, for any 
Wq G F, with the Jankov-Fine formula S{F)Apwo, then F is a A-frame. 

Proof. If F is not a A-frame, then there is a Kripke model M with 
frame F and some (p & A such that (M, wq) \= -^figo, . . . ,qn) for some 
Wq e F. If a is consistent with S{F) A Ptyj,, then there is a Kripke 
model satisfying {N,Uo) |= A A S{F) Apwg- By Lemma 7.1, there is an 
assignment qi ^ ipi, where ipi is a Boolean combination of the Pw in N, 
such that {N,uo) \= -^(p{ipo, . . . ,ipri)- This contradicts a substitution 
instance of {N, uq) |= A, since (p E A. □ 

Similarly, the concepts of button and switch are not set theoretic; 
they make sense in any Kripke model. Specifically, a button is a state- 
ment that is necessarily possibly necessary, and a switch is a statement 
such that it and its negation are necessarily possible. A family of 
buttons {&i}jg7 and switches {sj}j^j is independent in M at world u 
if none of the buttons is necessary at u and necessarily, any button 
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can be turned on and any switch can be turned either on or off with- 
out affecting the other buttons and switches. This can be expressed 
precisely in modal logic as follows. For any AC/ and B C let 
Qa,b = (AiGA ° bi) A (A,^A - □ A (AjeB s,) A (A,-^b -s^) assert that 
the pattern of buttons and switches is specified by A and B. A family 
{bi}i^i U of buttons and switches is independent if: 

iel AC I A<ZA' 

EC J B' CJ 

Thus, the buttons are off initially, and necessarily, from any possible 
pattern of buttons and switches, any larger pattern of buttons and any 
pattern of switches is possible. The main technique in our proofs of 
Lemmas 6.2 and 6.3 appears to be very reminiscent of Smoryhski's 
[Smo93] proof of de Jongh's theorem [dJ70] on Heyting's Arithmetic. 

Lemma 7.3. If F is a finite pre-lattice, wq E F and A ^ S4 is a 
modal theory consistent with a sufficiently large independent family of 
buttons and switches, then A is consistent with the Jankov-Fine formula 
S{F)Ap^,. 

Proof. Suppose that (M, uq) |= A has a sufficiently large independent 
family of buttons and switches. The proofs of Lemmas 6.2 and 6.3 work 
in M. Specifically, in those arguments we assigned to each node w in 
F an assertion p^,, a Boolean combination of buttons and switches, so 
that at any world u accessible from uq in M, exactly one of the Pw is 
true, and if p^ is true then O Pv holds if and only if -u < f in F. Thus, 
(M, Mo) 1= ^(-^)- By assigning the pattern of switches that happens to 
hold in M at Uq to the node Wq, we also arranged (M, uq) \= p^^. So A 
is consistent with the Jankov-Fine formula S{F) A p^^. □ 

The lemmas combine to prove Theorems 6 and 7 as follows. Let 
A be the ZFC-provable principles of forcing. It is easy to see that 
A is closed under substitution, modus ponens and necessitation. By 
Theorem 3, we know S4.2 C A. By Lemma 6.1, if ZFC is consistent, 
then there are models of set theory having infinite independent families 
of buttons and switches. It follows that A is consistent with arbitrarily 
large finite independent families of buttons and switches. By Lemma 
7.3, therefore, A is consistent with the Jankov-Fine formula S{F) Ap^o 
for any finite pre-lattice F. By Lemma 7.2, therefore, all such F are 
A-frames. By Lemma 6.5, any statement not in 54. 2 fails in a Kripke 
model having such a frame and consequently is not in A. So A C S4.2 
and, consequently, A = S4.2. 
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Let US now push these techniques a bit harder, in order to arrive at a 
new class of frames complete for S4.2 and some useful characterizations 
of S4, S4.2 and S5. A partial pre-order {B, <) is a pre-Boolean algebra 
if the quotient partial order B/= is a Boolean algebra. 

Lemma 8. For any natural numbers n and m, there is a Kripke model 
N whose frame is a finite pre-Boolean algebra, such that at any initial 
world in N, there is an independent family ofn buttons andm switches. 

Proof. Using power sets, let F = P(n) x P(m), so that the nodes of F 
consist of pairs {A, B), where AQn = {0,...,n— 1} and B C m = 
{0,...,m — 1}. The order is determined by the first coordinate only, 
so that {A, B) < (A', B') if and only if A C A'. This is clearly a partial 
pre-order. The corresponding equivalence relation is (A, B) = {A', B') 
if and only if A = A', and so the quotient is isomorphic to the power 
set P(n), which is a finite Boolean algebra. So F is a finite pre-Boolean 
algebra. Let N be the Kripke model on F in which hi true at (^4, B) 
when i & B and Sj true at {A, B) when j & B. Clearly, every bi is a 
button in and every Sj is a switch in A^, and they are independent at 
any initial world of A^, because whatever the pattern {A, B) of buttons 
and switches in any world of A^, any larger pattern of buttons A' D A 
and any pattern of switches B' C. m is possible. □ 

The Kripke model A^ produced in Lemma 8 has the smallest frame 
supporting an independent family of n buttons and m switches, because 
for independence one one needs worlds realizing every pattern {A, B) 
of buttons and switches. A class F of frames is complete for a modal 
theory A if every F G F is a A-frame and any (p true in all Kripke 
models having frames in F is in A. 

Lemma 9. A class F of frames is complete for SA. 2 if and only if every 
F & ¥ is an S4.2 frame and there are Kripke models, with frames in ¥, 
for arbitrarily large finite independent families of buttons and switches. 

Proof. The forward implication is immediate, because S4.2 is consistent 
by Lemma 8 with the existence of large independent families of buttons 
and switches. Conversely, suppose the latter property. If (po is not in 
S4.2, then by Lemma 6.5 there is some Kripke model M whose frame F 
is a finite pre-lattice such that (M, wq) \= -"foi^lo, ■ ■ ■ ,Qn)- Let (A^, Uq) 
be a Kripke model with frame in F having an independent family of n 
buttons and m switches, where n is the number of clusters in F and 
the size of any cluster is at most 2™. By the proof of Lemma 7.3, 
there are assertions pw for w e F such that {N,uo) \= S{F) Ap^g. By 
Lemma 7.1, there is an assignment of the propositional variables Qi of 
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M to assertions tpi in N such that (M, wq) |= ^^(go, • • • , 5n) if and only 
if {N, uq) 1= (/^(V'o; ■ ■ ■ ; V'n)- By the assumption on </7o, this means that 
{N,uo) 1= -i</9o('^oi • • • I V'n)- Thus, a substitution instance of ipo fails 
at a world in A^, a Kripke model whose frame is in F. So this class of 
frames is complete for S4.2. □ 

Theorem 10. The following sets of frames are complete for SA. 2. 

(1) Finite directed partial pre-orders. 

(2) Finite pre-lattices. 

(3) Finite baled pre-trees. 

(4) Finite pre-Boolean algebras. 

Proof. All of these frames are directed partial pre-orders, and so they 
are all S4.2 frames. Lemma 6.5 shows that any statement not in S4.2 
fails in a Kripke model whose frame is a finite baled pre-tree, and hence 
a finite pre-lattice and a finite pre-order, so these classes are complete 
for S4.2. The new part of this theorem is (4). By Lemma 8 the class 
of finite prc-Boolean algebras have Kripke models for arbitrarily large 
finite independent families of buttons and switches. So by Lemma 9, 
this class is also complete for S4.2. □ 

Let us summarize what we have proved about S4.2: 

Theorem 11. Suppose that the modal theory A contains S4 and is 
closed under substitution. For any class F of finite frames complete for 
S4.2, the following are equivalent: 

(1) A is consistent with arbitrarily large finite independent families 
of buttons and switches. 

(2) A is consistent with the J ankov-Fine formula S{F) Apu, for any 
frame F e F and world w & F. 

(3) Every frame in ¥ is a A-frame. 

(4) A C S4.2. 

Proof. Lemma 7.2 shows that (2) implies (3), as the elements of F must 
be finite directed partial pre-orders. For (3) implies (4), observe that 
if </? ^ S4.2, then it must fail in a Kripke model whose frame is in F, 
contrary to (3). For (4) implies (2), note that S4.2 and S{F) A p^j, 
are true together in the Kripke model having frame F, with p^^ true 
exactly in world w. For (4) implies (1), if A C S4.2, then A is true in the 
Kripke models constructed in Lemma 8, which have large independent 
families of buttons and switches. Finally, Lemma 7.3 shows that (1) 
implies (2) in the special case where F is the class of all finite pre- 
lattices, and hence (1) implies (4) for any F, since they do not depend 
on F, completing the proof. □ 



18 



JOEL DAVID HAMKINS AND BENEDIKT LOWE 



Our later analysis will benefit from similar characterizations of S4 
and S5. For S5, we use the fact that the class of finite complete reflexive 
graphs are complete for S5. This result will be applied in Theorem 16. 

Theorem 12. Suppose that a modal theory A contains S4 and is closed 
under substitution. Then the following are equivalent: 

(1) A is consistent with arbitrarily large finite independent families 

of switches. 

(2) A is consistent with the J ankov- Fine formula 5{F) Apu, for any 
finite complete graph F and world w & F. 

(3) Every finite complete reflexive graph is a A-frame. 

(4) A C S5. 

Proof. For (1) imphes (2), the point is that when F has only one cluster, 
the argument of Lemma 6.3 does not require any buttons. Suppose that 
iV is a Kripke model having an independent family of switches {sj}j^j. 
For any A C. J, define sa as in Lemma 6.3 to assert that the pattern 
of switches is A. Partition the collection oi A C J among the worlds 

— * 

u E F hy assigning a nonempty set A^ of sets to each world it in F. 
Let s„ = Aaga as in Lemma 6.3. By assigning whatever pattern of 
switches holds at uq to the world w, we can arrange that {N, uq) \= s^,. 
Since every world must have some unique pattern of switches, it follows 
that (M, Mo) satisfies that necessarily, exactly one s„ is true. And since 
the switches are independent, we also know that (M, -Uq) |= □ s„ for 
any u & F. Since all worlds in F are accessible from each other, this 
implies {N,Uo) \= S{F) Apw, as desired. 

Lemma 7.2 shows that (2) implies (3). And (3) implies (4) because 
any statement not in S5 is known to fail in a Kripke model whose 
frame is a finite complete reflexive graph (see [CZ97, Proposition 3.32, 
Corollary 5.29]). Finally, if A C S5, then A holds in any Kripke model 
whose frame is a complete graph. It is easy to arrange independent 
families of switches in such Kripke models, just by ensuring that every 
possible pattern of switches is exhibited in some world. □ 

In the S4 context, one can generalize Theorems 11 and 12 to the 
following, which we expect will be relevant for Conjecture 35. Recall 
that a modal logic has the finite frame property if whenever O 1/ (/?, 
then there is a finite 0-frame F and a Kripke model M with frame F 
in which (p fails. Such theories as S4, S4.2, S4.3 and S5 are known by 
[CZ97, 5.29, 5.32, 5.33] to have the finite frame property. 

Theorem 13. Suppose that Q is a modal logic containing S4 and has 
the finite frame property, such as SA, S4.2, S4.3 or S5. // A contains 
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S4 and is closed under substitution, then for any class ¥ of frames 
complete for Q, the following are equivalent: 

(1) A is consistent with the Jankov-Fine formula 5{F) f\pwo for any 
frame F G F and world wq G F. 

(2) Every frame in ¥ is a A-frame. 

(3) A C e. 

Proof. If the Jankov-Fine formula S{F) A p^i,,, holds in a Kripke model 
{N,Uo) \= A, then by Lemma 7.1, any Kripke model M with frame F 
has an assignment Qi h- ipi such that {M,wo) \= ^{qo, ■ ■ ■ ,qn) if and 
only if {N, uq) |= (p{ipo, ■ ■ ■ , i^n}- In particular, if (/? fails in such an M, 
then the corresponding substitution instance of it will fail in N |= A. 
So every such F is a A-frame, and we have proved (1) implies (2). For 
(2) implies (3), observe that if tp is not in 0, then it fails in a Kripke 
model M having a finite frame F G F. Since F is a A-frame, we know 
M \= K and consequently ip is not in A. So A C 0. For (3) implies (1), 
observe that the Jankov-Fine formula 5(F) /\pwQ is easily satisfied at a 
Kripke model M having frame F, where Pw is true exactly at w. Since 
F is a 0- frame, we know M |= and consequently M |= A by (3), so 
(1) holds, and the proof is complete. □ 

We do not have a button-and-switch characterization of S4 in The- 
orem 13, because the frame of an S4 model need not be directed, and 

it is not true that every possibly necessary statement is necessarily 
possibly necessary. Under 54, one can have assertions (p such that, si- 
multaneously, if is possibly necessary, ^tp is possibly necessary, and ip 
is possibly a switch. Thus, for the 54 context, we emphasize the official 
definition of button as a statement that is necessarily possibly neces- 
sary. Such examples show that unlike 54.2, under 54 it is no longer 
true that every statement is a button, the negation of a button or a 
switch. 

4. Forcing over a fixed model of set theory 

While our main theorem establishes that the ZFC-provable principles 
of forcing are exactly those in 54.2, it is not true that every model of 
set theory observes only these validities. For any W \= ZFC, recall 
that a modal assertion is a valid principle of forcing in W if for all 
sentences ■0^ in the language of set theory we have W |= 9?(i,t'o, . . . , V'n)- 
For meta-mathematical reasons connected with Tarski's theorem on 
the non- definability of truth, there is initially little reason to expect 
that the collection of such ip should be definable in W] rather, the 
assertion that ip is valid in W is expressed as a scheme, asserting all 
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substitution instances (p{ipo, ■ ■ ■ , i^n) ^ ■ So this is formally a second- 
order notion. Because a statement is provable in ZFC exactly when it 
holds in all models of ZFC, our main theorem establishes that the modal 
assertions (f that are valid in all models of set theory are exactly those 
in S4.2. Our proof, however, established the following stronger result. 

Theorem 14. If W is a model of set theory with arbitrarily large finite 
independent families of buttons and switches, then the valid principles 
of forcing in W are exactly S4.2. 

This result is stronger because it shows that the minimal set of forc- 
ing validities is reahzed in a single model of set theory (such as any 
model of V = L) , rather than arising as the intersection of the vahdities 
of several models. Nevertheless, there arc models of set theory whose 
valid principles of forcing go beyond S4.2. For example, the Maximality 
Principle MP of [Ham03] asserts all instances of the scheme O Dijj ^ ip, 
so that any set theoretic statement ip that holds in some forcing ex- 
tension and all further extensions is already true. In other words, MP 
asserts that S5 is valid for forcing. Because it is established in [Ham03] 
that if ZFC is consistent, then so is ZFC -|- MP, we conclude: 

Theorem 15. // ZFC is consistent, then it is consistent with ZFC that 
all S5 assertions are valid principles of forcing. 

The forcing validities of a model, however, never go beyond S5. 

Theorem 16. The valid principles of forcing in any model of set theory 
are included within S5. 

Proof. Let A be the set of forcing vahdities in a model W of set theory. 

By Theorem 3, this includes all of S4.2. Also, A is easily seen to be 
closed under substitution. Observe next that any model of set theory 
has an infinite independent family of switches, such as s„ = "the GCH 
holds at 'i^n" These and their negations are forceable in any finite 
pattern over any model of set theory by well known forcing arguments. 
It follows that A is consistent with the modal assertions that there are 
large independent families of switches. By Theorem 12, consequently, 
A C S5. □ 

Corollary 17. // ZFC is consistent, then there is a model of set theory 
whose valid principles of forcing are exactly S5. 

Our results establish that both S4.2 and S5 are realized as the exact 
set of forcing validities of a model of set theory (realized, respectively, 
in models of V = L or of MP) . 
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Question 18. Which modal theories arise as the valid principles of 
forcing in a model of ZFC? 

For example, can there be a model of set theory whose valid principles 
of forcing are exactly Dm. 2 or exactly S4.3? We have seen that if 
a model of set theory has sufficiently many independent buttons and 
switches, then the valid principles of forcing will be only S4.2. At the 
other extreme, if there are no buttons, then MP holds and so the valid 
principles of forcing in the model will be S5. Is it possible to have 
a model with a finite bound on the size of an independent family of 
buttons? 

Question 19. Is there a model of ZFC with one unpushed button hut 
not two independent buttons? 

What are the valid principles of forcing in such models? It is clear 
that if there are only finitely many buttons in a model (meaning that 
the independent families of buttons have some bounded finite size), 
then we could use Lemmas 6.3 and 6.4 to simulate any Kripke model 
on a pre-lattice frame with a correspondingly bounded number of clus- 
ters. The various classes of such frames generate modal theories strictly 
between S4.2 and S5. Are these realizable as the forcing validities of 
models of set theory? Are these the only modal theories that arise? 
The next theorem is a start on these questions. Denote the collection 
of modal assertions (/? that are valid in W by Force^. Two buttons 6o 
and hi are semi-independent if both are unpushed and one can push 6o 
without pushing hi. 

Theorem 20. Suppose that W is a model o/ZFC set theory. 

(1) S4.2 C Force^ C S5. 

(2) IfW has no unpushed huttons, then Force^ = S5. 

(3) IfW has at least one unpushed button, then Forcc^^ C S5. 

(4) // W has two semi-independent buttons, then W5 is not valid 
in W, and so S4W5 ^ Force^. 

(5) // W has two independent buttons, then .3 is not valid in W, 
and so S4.3 % Force^. 

(6) // W has an independent family of one button and one switch, 
then Dm is not valid in W, and so Dm ^ Force'^. 

Proof. Statement (1) is the content of Theorems 3 and 16. Over S4, 

the additional S5 axiom is equivalent to O □ □ which exactly 
asserts that every button is pushed. So (2) and (3) hold. For (4), 
suppose that ho, hi are semi-independent buttons in W, and let ip — 
(-1 □ 6o A -1 □ 6i) V D{ho A hi), which asserts that either none or both 
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buttons are pushed. Thus, is both true and possibly necessary in 
VF, since the buttons are initially unpushed and we could push both, 
but 9? is not necessary, since we could push just &o: this violates W5. 
For (5), suppose that W has two independent buttons h\ and 62- We 
argue as in Observation 4. Let = □ 61 A -> □ 62 and = □ 62 A -> □ 61. 
Since both buttons are unpushed in W and either may be pushed, we 
conclude that W \= <> 'p A Oip. But in any forcing extension oi W, if 
if is true, then ip is impossible and vice versa. So this instance of the 
conclusion of .3 fails in W. Thus, .3 is not valid in W, and so Force^ 
does not include S4.3. For (6), suppose that W has an independent 
family of one button b and one switch s. We follow the argument of 
Observation 4, case Dm. We may assume that both □ b and s are false 
in W. Let (/? = □ 6Vs. This is possibly necessary in W, since one could 
push the button b, but not true in W, so O Hip —>■ ip is false in W. 
In any forcing extension of W, if o{(p 0(p), then it must be that 
the button b has been pushed there, since otherwise one could have </? 
true and then false again by flipping the switch s. So we have argued 
that (□(93 — >■ □ (fi)) — >■ (fi holds in every forcing extension of W. Thus, 
the hypothesis of this instance of Dm holds in W, while the conclusion 
fails, so Dm is not valid in W. This establishes (6). □ 

Semi-independent buttons are part of the following more general ar- 
rangement. A list of assertions (pi, . . . ,(pn is a volume control if each 
is a button, pushing any of them necessarily also pushes all the previ- 
ous, and any of them can be pushed without pushing the next. More 
precisely: 

□ /\{n (pi+i ^ ncpi) A{on cpi+i) a □ cpi+i o{^(Pi+i a □ cpi)). 

i<n 

The idea is that one can turn up the volume to level j by forcing 
Uipj, but there is no turning it down again. The volume control has 
volume zero if -> □ v^i (and so a volume control of length n has n + 1 
many volume settings). These volume controls exhibit dependence of 
buttons, in a linear fashion, rather than independence. If buttons 60 
and bi are semi- independent, then □ 60) '^{i>o Abi) is a volume control 
of length 2; conversely, every volume control of length 2 (and volume 
zero) consists of two semi-independent buttons. Similar ideas with 
more buttons produce arbitrarily long volume controls. A Kripke model 
with a linear frame of n + 1 clusters admits volume controls of length n 
but no independent buttons. A family of volume controls, buttons and 
switches is independent in a model if all the volume controls have zero 
volume in that model, all the buttons are unpushed in that model, and 
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in any forcing extension, one can operate any of the volume controls, 
buttons and switches without affecting any of the others. 

Theorem 21. If W is a model of set theory exhibiting arbitrarily long 
volume controls independent from arbitrarily large families of indepen- 
dent switches, then Force'^ C S4.3. 

Proof. We know by [CZ97, 3.31, 3.32, 3.40, 5.33] that the finite hnear 
pre-orders are a complete class of S4.3 frames. Suppose that F is such a 
finite linear pre-order and Wq is a node in the minimal cluster of F. Let 
Vi, . . . , w„ be a volume control in W , where n is the number of clusters 
of -F, and suppose that this volume control forms an independent family 
with the switches Sq, . . . , s^, where the size of any cluster is at most 
2"*. As in Lemmas 6.2 and 6.3, we will assign to each node w e F an 
assertion p^, so that W satisfies the Jankov-Fine formula 5{F) Ap^g. 
Specifically, within each cluster [u], assign to each node w E [u] a 
nonempty set Ay, of subsets A C n in such a way that these partition 
all subsets A C n, and define = V^ga Lemma 6.3. In the 

least cluster, we assign the pattern A of switches holding in W to the 
node Wq. Now, for any node w G F, if w is in the i^^ cluster, then wc 
define p^, = Vi A s^,. That is, the volume control indicates the intended 
cluster and the switch indicates the intended node within that cluster. 
Since every forcing extension of W exhibits some volume setting and 
some pattern of switches, it is clear that it will satisfy exactly one of 
the pw, and in any extension of W where p^] holds, then Opv holds 
if and only if w < v. Thus, the Jankov-Fine formula S{F) A Pw^ is 
satisfied. It now follows by Theorem 13 that F is a Force'^-frame. So 
every S4.3-frame is a Forced-frame, and so Force^ C S4.3. □ 

Wc close this section with a curious question. A modal theory is nor- 
mal if it is closed under modus ponens, substitution and necessitation. 
All the named modal theories that we have considered, such as S4, 54. 2, 
S4.3, Dm. 2, 55 and so on, are normal. Meanwhile, the vahd principles 
of forcing in any model of ZFC is easily seen to be closed under modus 
ponens and substitution. But is it closed under necessitation? 

Question 22. If Lp is a valid principle of forcing, does it remain valid 
in all forcing extensions? 

In other words, is Uip also valid? Equivalently, if W |= ZFC, then is 
Force^ normal? Of course, if Force^ is 54.2 or 55, then the answer is 
yes, so this question is related to Questions 18 and 25. 
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5. The modal logic of forcing with parameters 

We know from [Ham03] that parameters play a subtle role in the 
strength of the Maximahty Principles. While MP is equiconsistent with 
ZFC, allowing real parameters in the scheme results in the principle 
MP(]R), which has some large cardinal strength; allowing uncountable 
parameters leads to inconsistency. Allowing real parameters from all 
forcing extensions leads to a principle □ MP(M) with a large cardinal 
strength of at least infinitely many Woodin cardinals (but less than 
AD]R + © is regular) . So let us analyze the role played by parameters 
in the valid principles of forcing. Specifically, define that Lp{qQ, . . . , qn) 
is a valid principle of forcing in a model W with parameters in X if for 
any set theoretical formulas ipi{x) we have 

We denote the collection of such (p by Force^(X). The next theorem 
provides another answer to Question 2. 

Theorem 23. In any model of set theory, the modal assertions tp that 
are valid principles of forcing with all parameters are exactly those in 
S4.2. Succinctly, Force^(W^) = S4.2. 

Proof. Certainly any S4.2 assertion is a valid principle of forcing with 
any parameters, by the argument of Theorem 3, which did not depend 
on whether there were parameters or not. For the converse direction, 
we argue as in the Main Theorem, using the following fact, that with 
sufficient parameters one can always construct independent families of 
buttons and switches. 

Lemma 23.1. // W is any model of ZFC, then with parameters lJ^ for 
n & CO, there is an infinite independent family of buttons and switches. 

Proof. Let bn be the assertion "a;^^ is not a cardinal" and let Sm be 
"the GCH holds at referring to ^uj+m de dicto, rather than with 

a parameter. In any forcing extension of W, any of the buttons can be 
forced without affecting the truth of the other buttons, by collapsing 
^^+1 predecessor (see [JecOS, 15.21]). After this, the switches 

Sm and their negations can be forced in any desired pattern without 
adding bounded sets below K^^ and, consequently, without affecting the 
buttons bn (see [JecOS, 15.18 & related]). □ 

The result now follows from Theorem 14 and the observation that the 
existence of parameters can simply be carried through that argument. 
Specifically, if ip is not in S4.2, then it fails at some world wq in a Kripke 
model M whose frame is a finite pre-lattice. As in the Main Theorem, 
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we use the buttons and switches to define p^j for each world w in M 
verifying the Jankov-Fine formula as in Lemma 6.3. If we define ■0? as 
in Lemma 6.4, then we observe as before that (M, Wq) \= ip{qo, . . . , Qn) 
if and only if |= ^p{ipo, . . . , ipn)- Since (/? fails at Wq in M and the ipi 
are Boolean combinations of the buttons and switches, this produces a 
failing substitution instance oi(pmW using the same parameters. □ 

Theorem 24. For any W \= ZFC and any set X of parameters in W , 

S4.2 C Force'^(X) C Force^ C S5. 

IfXCY, then 

S4.2 C Force^(F) C Force^(X) C Force^ C S5. 

Proof. Certainly any S4.2 assertion is valid, even with parameters, so 
S4.2 C Force'^(X). The proof of Theorem 16 is not affected by the 
presence of parameters, so Force^(X) C S5. li X C Y, then it is 

at least as hard for a modal assertion (/? to be valid for all substi- 
tution instances using parameters in Y as for parameters in X, so 
Force^(F) C Force^(X). Finally, Force^ = Force^(0). □ 

Question 25. Can the set of forcing validities Force^(X) be strictly 
between S4.2 and S5? When is it equal to S4.2 or to S5? 

For example, in the proof of Theorem 23, we only used parameters 
, so we may conclude: 

Corollary 26. For any model W of set theory, Force'^(J^Jf ) = S4.2. 
More specifically, Force'^({a;^ | n e a; }) = S4.2. 

Corollary 27. // a model W of set theory is absolutely definable in 
all forcing extensions (by the same formula, without parameters), then 
Force^ = S4.2. 

Proof. If W is absolutely definable, then the are also absolutely 
definable, thereby avoiding in Theorem 23 the need for them to appear 
explicitly as parameters. □ 

An essentially identical argument shows, more generally, that if W 
is absolutely definable from parameters in X, then Force '^(X) = S4.2. 
In particular, no such 1^ is a model of the Maximahty Principle. We 
now push the parameters a bit lower. Let H^^ denote the collection of 
sets having hereditary size less than 002- 

Theorem 28. For any model W of set theory, Force^(ifa;2) — S4.2. 
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Proof. We will build an independent family of buttons and switches. 
In W, let cui — LJ^ Sn be a partition of cui into infinitely many disjoint 
stationary subsets Sn- Let bn assert "S'„ is not stationary". Each 
assertion bn is false in W, since the Sn are stationary there, but in 
any forcing extension, by shooting a club through the complement of 
any Sn, we can force bn to be necessary, while preserving all stationary 
subsets of the complement of Sn (see [Jec03, 23.8, ex. 23.6]). Thus, in 
any forcing extension of W, we can push button bn without affecting 
any of the other buttons. (Note that this forcing collapses cui when Sn 
is the sole remaining stationary set on the hst.) So the buttons 6„ are 
independent in W. For switches, let Sk assert that the GCH holds at 
i^fc-(-2. By forcing over W or any extension we can arrange the switches 
in any finite pattern, without adding subsets to uj^ and consequently 
without affecting the buttons. So W has an infinite independent family 
of buttons and switches using parameters in H^^ , and so by Theorem 
14 we conclude Force^(//^) = S4.2. □ 

This stationary set idea provides an alternative source of indepen- 
dent buttons for Lemma 6.1, because if V = L, then one can use the 
L-least partition of uji into u many stationary sets; one advantage 
here is that this provides arbitrarily large finite independent families of 
buttons that can be pushed without collapsing cardinals. Indeed, the 
button to collapse cu\ is equivalent to the infinite conjunction of these 
independent buttons. 

Returning to Question 25, we observe that if is a model of V = L 
or if Force^ = S4.2, then clearly all the classes line up on the left 
side with Force^^''(X) = S4.2. li W \= MP, then Force^ = S5 is 
on the right. If ^ MP(R), then Force^(R) = S5. If X has any 
uncountable parameter x, then the assertion i/j = "x is countable" is 
possibly necessary but not true in W; consequently, O Dip ip fails in 
W, and so Force^(X) 7^ 55. More generally, if X has an element from 
which o;}^ is absolutely definable, then Force^(X) 7^ 55. In fact, since 
CH is always a switch and independent from "cuY is countable," we can 
conclude in this case that Dm is not valid, so Dm ^ Force'^(X). If 
the set of parameters supports long volume controls with independent 
switches, then Force^(X) C 54.3. If it supports many independent 
buttons and switches, then Force^(X) — 54.2. The situation 54.2 C 
Force^(X) C 55 would occur if one could construct at least one button 
in W using parameters in X, but not arbitrarily large finite independent 
families of buttons and switches. 

The hypothesis 55 C Force^(M) is equivalent to W \= MP(M), which 
has large cardinal consistency strength. Specifically, [Ham03] shows 



THE MODAL LOGIC OF FORCING 



27 



it to be cquiconsistent over ZFC with the existence of a stationary 
proper class of inaccessible cardinals. It is natural to inquire about the 
strength of weaker hypotheses concerning Force^(M). For example, we 
prove next that Dm C Force^(R) already has large cardinal strength. 
Define that Ui is inaccessible to reals if cui is an inaccessible cardinal 
in L[x] for every real x (equivalently, if a;^'^'^' < uui for all a; e R). The 
assertion that there is a stationary proper class of inaccessible cardinals 
is expressed as a scheme in ZFC, asserting that every class of ordinals 
(definable from parameters) that is closed and unbounded in the class 
of all ordinals, contains an inaccessible cardinal. 

Theorem 29. // Dm is valid for forcing with real parameters, then uji 
is inaccessible to reals and every L[x] for a; G M has a stationary proper 
class of inaccessible cardinals. Indeed, L^^ -< L and even L^,Jx] -< L[x]. 

Proof. We show L^^^ ^ L by verifying the Tarski-Vaught criterion. This 
claim should be understood metatheoretically and proved as a scheme. 
Suppose that L |= 3viIj{u, v) where u G L(^^. If there is no such v inside 
L^-^, then the assertion <f{u) ="there is f G L^^-^ such that L |= iIj{u,v)" 
is false in W. But it is certainly forceably necessary, because we could 
make (p{u) true by collapsing cardinals until the least witness v in L 
is hereditarily countable. In other words, (p{u) is a button in W. The 
parameter u, being in L^^, is hereditarily countable and can therefore 
be coded with a real. Meanwhile, the assertion CH is a switch, and this 
switch is independent of (p{u), because the CH and its negation can 
be forced over any model without collapsing cui and therefore without 
affecting the truth of ip{u). Since we have an independent button and 
switch in W using a real parameter, it follows by Theorem 20, case 
(6), that Dm is not valid in W with real parameters, contrary to our 
assumption that Dm is valid for forcing over W with real parameters. 

By relativizing to any real x, we similarly conclude L^^Jx] -< L[x], 
again proved as a scheme. It follows by elementary set theory that 
ui is (strongly) inaccessible in L[x]. Also, if C C ORD is a definable 
proper class club in L[x], it follows that C H cui is unbounded in cui, 
and consequently coi e C. Thus, the class of inaccessible cardinals in 
L[x] is a stationary proper class, as claimed. □ 

Corollary 30. The following are cquiconsistent over ZFC; 

(1) ZFC + MP(]R). 

(2) ZFC + 55 with real parameters is valid for forcing. 

(3) ZFC + S4W5 with real parameters is valid for forcing. 

(4) ZFC + Dm. 2 with real parameters is valid for forcing. 

(5) ZFC + Dm with real parameters is valid for forcing. 
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(6) ZFC + there is a stationary proper class of inaccessible cardinals. 

Proof. The Maximality Principle MP(M) asserts exactly that Axiom 5 
is valid for forcing with real parameters, so (1) (2). Clearly (2) — >■ 
(3) ^ (4) ^ (5), since S5 D S4W5 D Dm. 2 D Dm. In fact, (4) ^ (5), 
since the axiom .2 is always valid. Statement (5) implies, by Theorem 
29, that (6) is true in L. Finally, if there is a model where (6) holds, 
then results in [Ham03] produce a model satisfying ZFC + MP(]R). □ 

The assertions in Corollary 30 should be understood as schemes as- 
serting the relevant substitution instances \/x G M lp{iPq{x), . . . , ipnlx)) . 

Question 31. Which modal theories arise as the valid principles of 
forcing with real parameters? 

We know that S4.2 C Force^(M) C S5, and both of these endpoints 
can occur. But is there any model of set theory W giving rise to any 
intermediate modal theory? 

6. Restricting to a class of forcing notions 

One can naturally restrict the scope of forcing extensions to those 
obtained by the members of a particular class F, so that Dr f means 
that (fi holds in all forcing extensions by forcing in F and Or f means 
that (/9 is forceable by some forcing in F. Natural classes F would 
include CCC forcing, proper forcing, and so on. The analogue of the 
Main Question becomes: 

Question 32. For a given class of forcing T, what are the valid prin- 
ciples of F forcing? 

There are many open questions here, which we leave for future 
projects. Let us close the paper by observing that even with CCC 
forcing, the situation changes dramatically. 

Theorem 33. // ZFC is consistent, then the ZFC-provable principles 
of CCC forcing do not include S4.2. 

Proof. It is easy to deduce in S4.2 the following Directedness axiom: 

{onip Aonip) ^ o n{(p a ijj). 

We will show that the CCC interpretation of this Directedness axiom 
is not valid in L. This proof relies on the fact, a part of mathematical 
folklore, that there are two fundamentally different ways to destroy a 
Suslin tree by CCC forcing. If T is a Suslin tree, then of course forc- 
ing with T itself adds a branch through T, making it non-Aronszajn. 
Alternatively, if T is Suslin, then there is CCC forcing making T into 
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a special Aronszajn tree, a union of countably many antichains (see 
[Jec03, 16.19 & related]). No further forcing can add a branch through 
this tree without collapsing cui, since the branch would have to contain 
at most one node from each antichain. Thus, these two alternatives 
cannot be amalgamated by CCC forcing. If (p is the assertion "the L- 
least Suslin tree is not Aronszajn" and ip is the assertion "the L-least 
Suslin tree is special," then each of these statements is possibly nec- 
essary by CCC forcing over L, but their conjunction is false in all CCC 
extensions of L. Thus, (Occc nccc A (Occc nccc i^) holds in L, but 
not Occc OcccXv ^ i')-! violating Directedness. □ 

Corollary 34. The same conclusion holds for any class V of forcing no- 
tions containing all CCC forcing, whose members in any CCC extension 
preserve uji . This includes the classes of proper forcing, semi-proper 
forcing, cardinal-preserving forcing, and so on. 

Proof. In the proof of Theorem 33, the assertions </? and are each 
CCC-forceably necessary in L and hence F-forceably necessary there, 
but the conjunction (/? A is not forceable by u;i-preserving forcing 
over L, and hence not F-forceable over L. So the F- forcing validities in 
L do not include S4.2. □ 

Nevertheless, one can easily verify that S4 remains valid for CCC 
forcing (and also for the other classes), and we conjecture that they do 
not go beyond this. 

Conjecture 35. The ZFC-provable principles of CCC forcing are ex- 
actly S4. 

A complete set of S4 Kripke frames consists of finite pre-trees (partial 
pre-orders whose quotients are trees) , and with them one might try to 
carry out a similar analysis as in our Main Theorem, by finding set 
theoretical assertions to fulfill the Jankov-Finc assertions. The point 
is that branching in these trees gives rise to behavior totally unlike 
either buttons or switches. Branching corresponds in set theory to the 
possibility of CCC forcing extensions that cannot be amalgamated by 
further CCC forcing, as in the folklore fact above, where one chooses 
either to specialize a Suslin tree of L or to make it not Aronszajn. 
What is needed, therefore, is an elaborate generalization of this folklore 
idea, in which one can successively make choices with CCC forcing that 
cannot later be amalgamated by CCC forcing, in such a way that every 
CCC forcing extension is included. 

Under Martin's Axiom MA, of course, the product of CCC posets is 
again CCC, and this imphes that the Directedness Axiom is valid for 
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CCC forcing. As a consequence, all S4.2 assertions are valid for CCC 
forcing over any model of MA. We conjecture that this also is optimal. 
To prove this, one would need to find a model of MA with arbitrarily 
large finite independent families of CCC buttons and switches. 

Conjecture 36. The ZFC + MA provable principles of CCC forcing are 
exactly S4.2. 

Lastly, we mention that for CCC forcing, unlike the general situation 
with Corollary 30, there is no large cardinal strength to the hypothesis 
that S5 is vahd for CCC forcing with real parameters. Specifically, 
[Lei 04] proves that if ZFC is consistent, then there is a model of ZFC in 
which every S5 assertion is valid for CCC forcing with real parameters. 
If one wants S5 to be valid for CCC forcing with parameters in H2^, 
however, then [Ham03] shows that it is equi consistent, as in Corollary 
30, with a stationary proper class of inaccessible cardinals. 
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